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NARRATIVE 


1 . On July 1 1 , 2007, the reporting agent received a lead referral from Special Agent 


(C) 


(b)(6), (b)(7)(C) 


|DCIS Mid-Atlantic Field Office regarding the Immigration and Customs 
Enforcement (ICE) initiated Operation Flicker. Operation Flicker is a nationwide 
investigation that has identified over 5,000 individuals that have subscribed to predicated 


child pornography websites. S A' n)<S) (b)(7!(C) sent a list of individuals in New York 
State that are employed by the Department of Defense/U.S. Military, that have subscribed 
to websites that contain child pornographic images or other material that exploit children 
via the internet. 


2. In April 2006, the ICE/Cyber Crimes Center/Child Exploitation Section (ICE/C3/CES) 
initiated an investigation into a criminal organization operating a commercial child 
pornography website known as “Home Collection.” The investigation has revealed that 
the same organization is operating numerous commercial child pornography websites. In 
addition, the organization utilizes various Pay Pal accounts to process the payments for 
access to the member restricted areas of these websites. The investigation is being 
worked jointly with ICE/C3/CES, ICE/RAC/Birmingham, the U.S. Postal Inspection 
Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, and 
the USAO for the Northern District of Alabama. ICE has designated this operation as 
PROJECT FLICKER. 

3. ICE/C3/CES has conducted over 60 undercover transactions at the advertising websites 
associated with this investigation. The investigation has identified that a specific 
criminal organization is operating approximately 1 8 different commercial child 
pornography advertising websites which provide access to approximately 1 8 child 
pornography member restricted websites. 


Among the 5,000 names ICE identified under Project Flicker, several individuals used 
their .mil e-mail add ress, Flee t Post Office (FPO), or Army Post Office (APO) military 

zip codes. SA^ 6) ; (b)<7>(C) advised the U.S. Attorney’s Office and ICE that the DCIS 

will assist in identifying any additional Department of Defense (DoD) affiliated 
individuals and provide any investigative assistance. 


5. SA 


(b)(6), (b)(7)(C) 


conducted queried DoD databases to identify individuals that may be in 


possession of child pornographic material or access, and has forwarded the results of his 
queries to the respective DCIS office for consideration for possible DCIS case initiations. 
SA |< t ’X6 ) . ( b)(7xc) | attached a spreadsheet for subjects of Operation Flicker in the state of 


New York that have a Do D affiliation. One subject identified on thespreadsheetjncludes 


an individual identified as 

1(6X6), (b)(7)(C) ~ ““ 


taB),(b)(7)(C) 


[(b)(6), <b)(7XC) 


The reporting agent queried the Defense Employ ee Inte ractive Data Systems (DE1 DS), 
and obtained the following information regarding <b,(6) ’ (b)(7XC) 

[(b)(6). (b)(7)(C) 
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The reporting agent also queried the Re-Enlistment Eligibility Data Display (REDD) 

database for| (bK6> (bX7XC) 

and obtained the following information: (bX6)(b)(7XC) 

(b)(6),(b)(7)(C) 

■ 

(b)(6), (b)(7)(C) 



8. The reporting agent contacted Speci al Agen t 


|(bX6), (b)(7)(C) 


regarding Operation Flicker. SA[ 


(b)(6), (b)(7)(C) 


ICE Alexandria Bay, NY 


subsequently forwarded the reporting agent a 
spreadsheet that identifies all New York subjects of Operation Flicker, and pertinent 
information regarding subscriber information related to the child exploitation websites. 
SA| (bK6) [b!(7><C) | advised that he would be reviewing the list of subjects for possible 
investigation. The reporting agent advised that the DCIS would review the list, and 
initiate an investigation of D oD related personnel in the Syracuse Post of Duty area of 
responsibility. SA (bii6),(b)(7><C) [advised that another ICE agent would be assigned to specific 


investigation, but he would assist in the computer forensics part of the cases. 


9. Upon review of the spreadsheet sent by SAj 

[(b)(6), (D)(7) 


[(C) 


<b!(6).(b)(7)(C) 


the reporting agent determined that 

made one payment utilizing PayPal to the restricted access websites. The 
transaction occurred on January 30, 2007 for $79.95. The “trans.Item Title” was either 
listed as an invoice number: Invoice # 41041 . (Agent Note: this is the subject line 
identifier which indicates which member restricted site a specific customer purchased. In 
the Project Flicker Overview report, it stated that in November 2006, the criminal 
organization omitted the subject line identifiers, and began using Invoice numbers. The 
ICE agent stated that the Pay Pal accounts still identify the specific member restricted 
sites an individual purchased). The reporting agent will review the spreadsheet, and will 
report the details under a separate Form 1. 


1(b)(6), (b)(7)(C) 


10. On November 16, 2007, the reporting agent, SA 

] conducted a consent search at the residence ofi 
1 interviewed! 


SA 


(b)(6), (b)(7)(C) 


reporting agen t and SA 


[(b)(6), (b)(7)(C) 


(b)(6), (b) 
(7)(C) 


(b)(6), (b)(7)(C) 


TPF C A 1(b)(6), (bT 
(7)(C) 

(b)(6), (b)(7)(C) 


and ICE 
The 


The interview report was written by S A ( ( c) <6) ' (b)(7) 


11. SA 


[(b)(6), (b)(7)(C) 


and SAf 


(b)(6), (b)(7)(C) 


conducted a preliminary computer forensic review of two 
desktop computers and one laptop computer. During the initial review of the computers, 
the agents discovered nu merous child por nographic materials on one of the computers 
believed to be utilized by (bX6> ' (b)l7,(C) The computer that contained the child 

pornographic material was seized by SA ::!: ' :6;:d>:/H0! jand ICE will maintai n custody o f the 
computer. The review/analysis of the computer will be conducted by sa| b)(6> ' b)<rxC) jafter a 


search warrant is issued by the U.S. District Court, Northern District of New York. 
During the next reporting period, it is anticipated that the search warrant will be issued 
for the complete examination of the seized computer. 


12. The reporting agent and SA; b)(6,,(b) 


Attorney (AUSA) 


!(bX6), (b)(7)(C) 


E2EL 


consideration of criminal prosecution o f bK6),(bK 7KC1 


have been in contact with Assistant United States 
[Northern District of New York, Syracuse, NY for 

in violation of Certain Activities 


Related to the Sexual Exploitation of Minors, Title 18 USC § 2252. 



13. In February 2008, the reporting agent obtained a copy of (bl<6ilibi (7i(C) military service 
records from the National Archives and Records Administration in St. Louis, MO. The 
records indicated that 


|(b)(6),(bX7){C) 


(b)(6), (bX7)(C) 




14. On January 15, 2008 , an application and affidavit for a Search Warrant was ordered by 


the 


(b)(6), (b)(7)(C) 


Northern District of New York 


for “one desktop computer, central processing unit, black and grey in color, identified and 
marked as a Dell Dimension, bearing serial number H3XQQ3 1 .” The search warrant was 
based upon the consent search that was conducted on November 16, 2007 for a computer 


belonging to |j£f )Xbx7) | that was determine to contain child pornographic images. The 
search warrant authorized the agents to conduct a thorough forensic exam ination o f the 
computer to attempt to substantiate the allegations regarding violations by j(Sf ),(bX7) | pf the 
Exploitation of minors under Title 18 United States Code § 2252. 


15. From a period of February 2009 to November 2009, the reporting agent attem pted to 

the status of the review of the forensic evidence. SAj 


determine from SA|i b)(6),(b) 


(7)(C) 


(b)(6).(b)(7) 

(C) 


advised that the computer forensic; was conducted and evidence was obtained that was 

(advised the reporting agent that he was 

requested by AUSAf 


(b)(6), (b)(7)(C) 


to determine if (cf ),(b>(7) was still engaged in 


pornographic material. 


16. On 22 October 2009, the reporting.agent contacted AUS/ 

[(b)(6), (b)(7)(C) 

jto determine the 

status of the potential for prosecution of 'cf ) (bX7) 

AUSA (t 

0(6), (b)(7)(C) , 

i 

idvised the she has not 

received a forensic report from SA 

(b)(6), (b)(7) 
(O) 

AUSA 

(b)(6), (b)(7)(C) 

further advised that she is 


planning to close her case due to lack of information/evidence on the case. AUSA 


(b)(6), (b)(7)(C) 


stated that she may conside r re-opening the case on| 


able to provide evidence thatp 6),(bX7) 


(b)(6), (b)(7) 

<c> 


if the agents were 


violated United States laws as codified under 


Exploitation of minors under Title 1 8 United States Code § 2252. 


17. This investigation is closed based upon the lack of participation by the Immigration and 
Customs Enforcement to present the forensic evidence obtained during the course of the 
investigation to the U.S. Attorney’s Office. This case may be re-opened if ICE presents 
this case for prosecution, and the U.S. Attorney’s Office accepts this case for prosecution, 


IDENTITY OF SUBJECTS 


Name 

Alias 

Social Security Number 

Date of Birth 

Sex 

Race 

Height 

Weight 

Eyes 

Haii- 

Residence 


1(b)(6), (b)(7)(C) 
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NARRATIVE; 

1 . On May 29, 2007, the DCIS Arlington Resident Agency (RA), initiated Project: 

Operation Flicker (CCN: 200701 199X) based on information provided by Assistant U.S. 
Attorney (AUSA) Gerald Smagala, U.S. Attorney’s Office (USAO), Eastern District of Virginia 
(EDVA), Alexandria Division. AUSA Smagala advised that the ICE was conducting a national 
investigation that identified over 5,000 individuals who subscribed to predicated child 
pornography websites. AUSA Smagala specifically requested DCIS assistance relative to any 
identifying DoD personnel. 


2. SA Victor ] DCIS Arlington RA, utilized information contained within the 
DoD Employee Interactive Data System and the Joint Personnel Adjudication Systems to 
identify DoD affiliated individuals. Among those identified wasp’^ , an employee 

of Oracle Corporation who supported a contract for the National Security Agency. A query of 

held a top secret clearance. 


JPAS revealed that|? bK?ut,) 


(7)(C) 


AUSA Smagala advised that p)[| (b) T was previously identified in another ICE operation 


that collected subscriber information to predicated child pornography sites. In 2003, under 
Operation Falcon, ICE executed a search warrant in Florida of a credit card processing company 
called Regpay. Among the items seized during the warrant were subscriber records. I was 1 
of 4 00 targets in Virginia who purchased subscriptions to various child pornography websites. 
7 XG) (bl had approximately 21 purchases, making him the largest buyer in Virginia. In addition, 
two other people a1 ( ( cf ),(bX7) residence purchased approximately 1 1 additional subscriptions. A 
review of|£f w “ )!7> ] credit card records revealed multiple purchases to child pornography websites. 
Federal search warrants were unattainable due to the staleness of the information gathered from 
Operation Falcon. $( ( c) ,(b) was never interviewed. However, under Operation Flicker^ 


«t»(6).(b) , 

(7)(cj was 


identified has making approximately four purchases. 


4. On June 2 1 . 2007. agents executed a search warrant onj 

ibX6),W(7XC) 


(b)(6), (b)(7) 
(C) 


residence located at 


(b)(6), (b) 

mra 


5. 


[(b)(6), (b)(7) 
(C) 


During a non-custodial interview of|( 7 )(C) (b> 


he stated that he worked for!' b)!6),lb)(7;,(C) 


and he had been doing computer work tor several years to include website consulting for 


pS) 

(7)(C) 


(said that it was fair to say that he had an interest in child pornography for about 3 
said that he spent about $50 to $60 monthly on the various 


6 . 

years prior to his interview, 
sexually explicit sites. 


(b)(6), (by 
[(7)(C) 


(b)(6).(b) 

(7)(C) 


the Internet history offTTfiTsystem. 


said t hat afte r each session on the computer (pom sites) he wiped 


1(b)(6), (b) 
:(7XC) 


said that there would be a mixture of porn ograph y on 


the computer; there will be adult pom, child porn, and sexual activity with animals, 
that his wife had no knowledge of his pornography interests. 


(b)(6), (b) 
(7XC) 


said 
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7. On June 20. 2007. S.A 


|(b)(6),<b)(7XC) 


at 


(b)(6), (b)(7)(C) 


met withlbjpjj representatives at their office located 


of both computers to SA 


1(b)(6), (b)(7)(C) 


advised that she was suspending all ofj 
administrative leave with pay. 


jfor forensic analysis. The 


(b)(6), (b)(7) 
(C) 


^access top^c 


|(bx 7 ) ( {repr esent atives agreed to the release 
human resources manager 
on 


(b)(6), 

(b)(7)( 


and was putting 


(b)(6), (b) 
(7)(C) 


9. On June 21, 2007, SA| (bl(6) ' (1)KY ){C) received an email containing 1 ^!™ ] parking records, 


related togf >(OK7) 


access toM?) [offices on June 19, 2007, the date of the search warrant. 


According to the [parking records, 


1(b)(6), (b) 
(7)(C) 


entered 


(b)(6), (b) 
1(7X0 


10:00:47 a.m. and exited at 1 1 :06:00 a.m. It appeared thatpxo 

‘I (b)(7) (C 


parkin g garage on June 19, 2007 at 

(b)(6), (b) l trave ]] ec j to 0 ffj C e at 


(b)(6), 

(bffilL 


after the search warrant on his residence, tampered with his (b>(6> 


issued computers, and left his 


office. 


10. On July 25, 2007, an additional search warrant was obtained foi (bK6) ' (bX7)<c> 
desktop computer. 


issued 


11. A forensic examination of I 


(b)(6), (b)(7) 
(C) 


computers revealed images of child pornography. 


12. On March 27, 2008, [^c)® was indicted in the U.S. District Court, Eastern District of 
Virginia, on two counts of attempted receipt of child pornography and possession of child 
pornography, a violation of Title 18, U.S. Code, Sections 2252A(a)(2) and 2252A(a)(5)(B). 


13. SAl (bX6i ; <b) ™ C) [advised tha|7K ( c) (b> fled the U.S. and was believed to be in Libya. On March 


28, 2008, an arrest warrant was issued fori 


(b){G),(b) 

IP XO 


14. On Septe mber 10. 2008, Inte rpol Washington issued red notice for 


reference numbeif 


W) 


of 2 September 2008. 


(b)(6), (b)(7) 
<C) 


arrest, 


15. Until (7xc) (b) is arrested and extradited to the U.S., no further criminal, civil or 


administrative activity by the DCIS will occur. This case is closed as “finished.’ 
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Narrative 


This case was initiated upon referral of the Defense Contract Management Agency (DCMA), 
Hartford, CT. On March 14, 20071' 


1(b)(6), (b)(7)(C) 




DCMA Hartford, requested DCIS 
assistance in evaluating possible child p ornog raphy i mages contained on t he ha rd drive of a 

government owned computer assigned t o l(bX6),(W(7 )(C ) t DCMA 

Hamilton Sundstrand. 


2. In January 2007, DCMA received a complaint indicating that 


|(bX6).(bK7XC) 


was using his governme nt 


1(b)(6), (b)(7)(C) 


computer to play games. DCMA Information Technology personnel remotely accessed! 
government computer and found evidence that he was accessing internet gaming websites and 
pornographic websites. On January 26, 2007, DCMA seized j ib)i6),(bX7XC: ' ] government computer 
hard drive for analysis. During a subsequent analysis of the hard drive, DCMA forensic 
examiners identified images that they thought could constitute child pornography. 


3. On March 14, 2007, 


(b)(6), (b)(7)(C) 


reviewing the contents of[ 


(bX6).(b)(7XC) 


DCMA Hartford, requested DCIS assistance in 
Jhard drive for evidence of child pornography. DCIS forensic 
examiners analyzed the hard drive, and identified approximately 40 images suspected of being 
child pornography. Each of these images was a so called “thumbnail” image, indicating that the 
image was reviewed on line, but was not downloaded. The images were run against the National 
Child Victim Identification Program (NCVIP), and none of the images was positively identified as 
a known child victim. 


4. On May 18, 2007, the reporting agent met with A ssist ant United States Attorney (AUSA) 


(b)(6), (b) 
(7)(C) 


to review the^suspect” images contained on 


images, AUSA§ b)(6),(b! 




l(bX6),(bX7XC) 


(bX6),(bf 

mo 


hard drive. After reviewing the 


indicated that while he believed the thumbnail images themselves did not 
constitute sufficient evidence to merit prosecution, any final decision regarding prosecution would 
have to be made by the Chief of the Criminal Division. Peter Jongbloed, Chief, Criminal 
Division, US Attorney’s Office for the District of Connecticut, was briefed by the reporting agent 

prior to any final decision on the disposition of the 


and requested that DCIS interview !bX6,(bX7,(0) 
case. 


5 . 


On June 21, 2007, the reporting agent interviewed 


|(bX6).(b)(7XC) 


(bK6),(bK7XC) 


admitted to playing on line 


games on his work computer for an average of three hours a day during his work day. He also 
admitted to accessing pornographic websites on his work computer during the work day, but 
denied ever downloading pornography on his work computer, and 
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|(b)(6).(b)(7XC) ' 


indicated that he also 


denied ever intending to view or possess child pornography. 

accessed pornography from his home computer, and over several years had downloaded 
approximately 5000 pornographic images on to a memory stick that he maintained at his home. 
When asked whether this memory stick contained images that would constitute child pornography, 


|M£6), (b)(7)(C) 


“questionable.’ 


stated that some of the images might “raise some eyebrows” and might be 


6. On June 22, 2007, 


1(6X6), (b)(7)(C) 


Jvoluntarily relinquished the memory stick and agreed to allow DC1S 
to search the memory stick for evidence of child pornography. Given the volume of forensic 
analysis already accomplished, and the amount required to complete this inquiry, the decision to 
open an investigation was made on June 25, 2007. 


7. The 2701 files contained on the memory stick were run against the National Child Victim 
Identification Program (NCVIP), and none of the images was positively identified as a known 
child victim. A number of suspect images were identified that possibly depicted minors engaged 
in sexual posing and sexual acts. Analysis of the images indicated that the individuals were not 
pre-teen in age, but pubescent and developed females, some of whom might be teenagers. 


8. On October 1 1 , 2007, the US Attorney’s Office declined prosecution o f, !b)(5: (bK7:(C1 Tor possession of 
child pornography. The declination was based upon an inability to determine the age or identity of 
the individuals depicted in the files,' r ' ! '" ! “ ! 7 iC ' statement that he did not intend to possess child 
pornography, :bK<5) :b;7!!C) cooperation in the investigation, and the number and nature of the vast 


majority of the images which were not child pornography. 


9. On July 8, 2008 


(b)(6).(b)(7)(C) 


completed a thirty day su spension imposed upon him by the 


KbpWb)(7)(C) 


suspension resulted from 


Defense Contract Management Agency (DCMA). 
admissions he made to the reporting age nt dur ing an i nter view relating to his extensive misuse of 

government time and resources. DCMA : stated that she was attempting 

through the Defense Finance and Accounting 


to recoup approximately $20,000.00 from/ 0 '' 6 '- (ax7)!C) 


Service (DFAS). This amount represents the dollar value of the time) 
gaming during the workday. 


spent computer 


10. On November 17, 2008, DCMA| 
recouping funds fromf )i6>,(b)(7)(C> 


(b)£6),{b)(7)(C) 


advised that she was unsuccessful in 


through DFAS. 


1 1 . This case is closed. There were no management control deficiencies identified during the course 
of this investigation. 


SIFICATION; 

-FOR-O FF i GIAL USE O Wfc¥ 




20070 1333L-25-JUN-2007-10HF-W1 


2 1 -NOVEMBER-2008 


Identity of Subject 


Name 

DoB 

SSN 

Alias 

Race 

Sex 

Employment/Occupation 


piw 


Prepared by SA 


1(b)(6), ibX?XC) 


New Haven RA 


APR: 


1(b)(6), (bX7)(C): 
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NARRATIVE 


1 . This investigation was initiated based upon a referral from SA] (bi(6), ?bii7|(Ci 


DCIS 


Arlington Resident Agency, identifying thirteen persons with ties to the Department of Defense 
who reside in the DCIS Valencia Resident Agency area of responsibility and were suspected of 

involvement in child pornography. SA| (b)(6>,<b)(7KP> J initially received the information from 

Assistant United States Attorney (AUSA) Gerald Smagala, United States Attorney’s Office 
(USAO), Eastern District of Virginia. The persons identified are active and retired military 
members, DoD civilians and DoD contractor employees, several of whom have Top Secret or 
higher clearances. 


2. In April 2006, the ICE/Cyber Crimes Center/Child Exploitation Section (ICE/C3/CES) 
initiated an investigation into a criminal organization operating a commercial child pornography 
website known as “Home Collection.” The investigation revealed that the organization operated 
numerous commercial child pornography websites. In addition, the organization utilized various 
PayPal accounts to process the payments for access to the member restricted websites. The 
investigation was worked jointly with ICE/C3/CES, ICE/RAC/Birmingham, the U.S. Postal 
Inspection Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, 
and the USAO for the Northern District of Alabama. ICE designated this operation ‘Project 
Flicker’. 


3. ICE/C3/CES conducted over 60 undercover transactions with the advertising websites 
associated with this investigation. The investigation determined that a specific criminal 
organization operated approximately 1 8 commercial child pornography portal websites which 
provided access to approximately 1 8 child pornography member-restricted websites, using a 
specific payment website known as “iWest.” The investigation identified that the criminal 
organization (1) used various PayPal accounts to facilitate the customer payments; (2) used 
specific subject identifiers within the PayPal accounts to identify purchases into the various 
member restricted websites; and (3) used specific administrative e-mail accounts that were used 
to distribute access to the member-restricted websites. 


4. Project Flicker data was sorted to identify individuals who used their personal e-mail 
addresses, .mil e-mail addresses, Fleet Post Office or Army Post Office military zip codes to 
register for the PayPal service to gain access the child pornography websites. The thirteen 
suspects identified in the 50VN AOR were titled as subjects based upon the initial evidence that 
was provided to the DCIS by ICE. Because the subjects are DoD employees who possess 
security clearances, ICE listed them as a Tier 1 priority. This investigation was coordinated with 
ICE Supervisory Special Agent[ 


1(b)(6). (b)(7)(C) 


|(bX6), (b)(7)(C) 


Senior Special Agent 
Bakersfield, and Special Agenf 


Child Exploitation Unit, Long Beach, CA. ICE 


(b)(6), (b)(7)(C) 


of ICE- Long Beach, Special Agent 


IbpM6j(7XC) - 


of ICE 


of ICE Camarillo were assigned as case agents. 


|(b)(6).(b)(7)(C) 


t(W>.-M(7) 
IfC) 


was interviewed by SA 
about his alleged purchases of child pornography. At the conclusion of the interview, 


is the husband of < bK6 » b > (7)(C) | a Navy E-5. 


(b)(6), (b) 
l(7)(C) 


A-l 
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August 1 4, 2009 


SAflr det ermined t hat pf i,!bl(7i purchase was accidental and not indicative of criminal 


behavior. SA 


(b)(6),<b)(7) 
(C) 


prosecution against(7xc) (b> 


interview was reviewed by the AUSA’s office in Fresno, CA and 
I was declined. 


6 


1(h)(6), (b)(7)(C) 


a civilian contractor at Edwards Air Force Base, CA, purchased two 


subscriptions to two different websites featuring child pornography on two separate occasions, 


at 

(b)(6), (b)(7)(C) 

home on February 28, 2008, (b,(6) ' (b)(7)!O> was present and was interviewed by SA| 

( b X 6 ).( b X 7 ) 

id i 

(b)(6), <bX7) 
(C> 

and SA 

(b)(6), (b, (7, (C, During the interyievv (OX6, .(») (7,(0 

stated that the computer he used to 


access the websites was located at the residence, and that he relied on disclaimers posted on the 
websites stating that the material was legal. (b)(6)M7XC) further stated that he never downloaded or 
saved any images or movies from the websites to his computer. The search 0 f (bl(6>,(b>(7i ‘ 5) 
residence revealed no child pornography at the resid ence or on his computer. Due to lack of 
evidence, ICE closed their investigation on l (b)(6i ' (bK7XcT ] (E X hibit 1). 


7. Christopher Oswald, a telephone maintenance worker at Naval -Air Station, Pt Mugu CA, was 
arrested on August 6, 2008, based on evidence discovered at his home during a California State 
search warrant executed by members of the Ventura County Sheriffs Office High Tech Task 
Force, ICE Camarillo, and DCIS. He was convicted on two counts of possession of child 
pornography under CA Penal Code 3 1 1. 1 1(a) and sentenced to 16 months incarceration, in 
addition to registration with the National Sex Offender Registry. Oswald was also 
administratively separated from his employment as a telephone installer on May 16, 2009 
(Exhibits 2, 4, 5, 6). 


8 


(b)(6), (b)(7)(C) 


Naval Air War fare Cente r, China Lake CA, 

turned over his 


(b)(6),(b)(7)(C) 


was being investigated by the Ridgecrest Police Department after| 
personal computer to a computer repair store for a hard drive swap. The repair technician 
discovered thousands of possible child pornography images and notified the police. 


1(0X6), (b)(7)(C) 


admitted to possessing the images and agreed to a search of his home. Before Deputy District 
Attorne# ™^ 


jcould formally charge him, 
obstructive pulmonary disease (Exhibits 3, 7). 


(bX6),(0X7)(C) 


died on July 6, 2009 of chronic 


9. For the remaining nine individuals, it was determined that the probable cause for search 
warrants was stale and that current, relevant evidence was not available. It was also determined 
that a portion of the original basis for the referral was unsubstantiated. The referral indicated 
that the subjects used their .mil accounts to register for and/or conduct the illegal purchase of 
child pornography. The use of a .mil account, in conjunction with the subjects’ military service 
connections, was considered sufficient nexus to initiate an investigation, but subsequent 
investigation of these thirteen suspects revealed no .mil accounts were used. 


10. With all relevant criminal activity addressed, this investigation is closed. No further judicial 
or administrative activity will occur. There were no management control deficiencies identified 
during the course of this investigation. 


A-2 
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IDENTITY OF SUBJECTS 

Name 

Alias 

Social Security Number 

Date of Birth 

Place of Birth 

Race 

Sex 

Height/ Weight 

Hair 

Eyes 

Residence 

Employment 

Occupation 

Telephone Number Home 
Telephone Number Bus 
Drivers License Number/Issuing 
Dependents 

Identifying Characteristics 


1(b)(6), M7XC) 
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IDENTITY OF SUBJECTS 


Name 

Alias 

Social Security Number 

Date of Birth 

Place of Birth 

Race 

Sex 

Height/ Weight 

Hair 

Eyes 

Residence 

Employment 

Occupation 

Telephone Number Home 
Telephone Number Bus 
Drivers License Number/Issuing State 
Dependents 

Identifying Characteristics 


Christopher Lester Oswald 
Chris Oswald 

f<b)(6),<b)(7)(C) 


Unemployed 

Teleco mmunic ations Repair 
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IDENTITY OF SUBJECTS 


Name 

Alias 

Social Security Number 

Date of Birth 

Place of Birth 

Race 

Sex 

Height/Weight 

Hair 

Eyes 

Residence 

Employment 

Occupation 

Telephone Number Home 
Telephone Number Bus 
Drivers License Number/Issuing State 
Dependents 

Identifying Characteristics 


1(b)(6), (b)(7)(C) 
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IDENTITY OF SUBJECTS 


Name 

Alias 

Social Security Number 

Date of Birth 

Place of Birth 

Race 

Sex 

Height/Weight 

Hair 

Eyes 

Residence 

Employment 

Occupation 

Telephone Number Home 
Telephone Number Bus 
Drivers License Number/Issuing State 
Dependents 

Identifying Characteristics 


1(b)(6). (b)(7XC) 
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Name 

Alias 

Social Security Number 

Date of Birth 

Place of Birth 

Race 

Sex 

Height/Weight 

Hair 

Eyes 

Residence 

Employment 

Occupation 

Telephone Number Home 
Telephone Number Bus 
Drivers License Number/Issuing State 
Dependents 

Identifying Characteristics 


|<bX6),(t>X7)(Cj 



20070 1 558M-3 1 -JUL-2007-50VN-W1 


August 14, 2009 


IDENTITY OF SUBJECTS 


Name 

Alias 

Social Security Number 

Date of Birth 

Place of Birth 

Race 

Sex 

Height/ Weight 

Hair 

Eyes 

Residence 

Employment 

Occupation 

Telephone Number Home 
Telephone Number Bus 
Drivers License Number/Issuing State 
Dependents 

Identifying Characteristics 


|(b)(6).(bX7)(C) 
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IDENTITY OF SUBJECTS 


Name 

Alias 

Social Security Number 

Date of Birth 

Place of Birth 

Race 

Sex 

Height/ Weight 

Hair 

Eyes 

Residence 

Employment 

Occupation 

Telephone Number Home 
Telephone Number Bus 
Drivers License Number/Issuing State 
Dependents 

Identifying Characteristics 
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NARRATIVE; 

1 . This case was initiated based on information derived from Defense Criminal 
Investigative Service (DCIS) Project: Operation Flicker (Case Control Number 200701 199X). 

2. As background, the DCIS Arlington Resident Agency, initiated Project: Operation 
Flicker based on information provided by Assistant U.S. Attorney (AUSA) Gerald Smagala, U.S 
Attorney’s Office, Eastern District of Virginia (EDVA), Alexandria Division. AUSA Smagala 
advised that the Immigration and Customs Enforcement was conducting a national investigation 
that identified over 5,000 individuals who subscribed to predicated child pornography websites. 
AUSA Smagala specifically requested DCIS assist in identifying DoD affiliated individuals and 
provide investigative assistance. 


3. Leland Chace Fitzpatrick was identified as 

[(b)(6), (b)(7)(C) 

(b)(6), (bX7XC) 

(b)(6). (b)(7XC) 



4. On August 2, 2007, agents executed a search warrant on Fitzpatrick’s residence located at 

<bX6).(b)(7)(c) Subsequent to the execution of the search 

warrant, agents conducted a non-custodial interview of Fitzpatrick. p^Mnic) I 


(bX6), (b)(7)(C) 




5. A forensic examination of an external hard drive seized from Fitzpatrick’s residence 
during the course of the search warrant, contained 93 documents, 8,400 pictures, and 200 movies 
that were evidence of the receipt of child pornography. 

6. On September 24, 2008, Fitzpatrick was arrested based on a criminal complaint issued on 
September 16, 2008 by the U.S. District Court, EDVA. 

7. On November 12, 2008, Fitzpatrick was indicted on one count of Title 18, U.S. Code, 
Sections 2252A(a)(2), receipt of child pornography, 2252A(a)(5)(B), possession of child 
pornography. 

8. On February 9, 2009, Fitzpatrick pled guilty to Title 1 8, U.S. Code, Section 2252A(a)(2), 
receipt of child pornography. The count of Title 18, U.S. Code Section 2252A(a)(5)(B), 
possession of child pornography was dismissed. 

9. On May 1, 2009, Fitzpatrick was sentenced to 60 months imprisonment, 60 months 
supervised release, and ordered to pay a $ 1 00 special assessment fee. 


A-l 


CLASSIFICATION: 

WARNING 

TTfctteewnant is the property of the Department of Defense Inspector General and is on 
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IDENTIFY OF SUBJECTS: 


Name 

Alias 

Social Security Number 

Date/Place of Birth 

Race 

Sex 

Height 

Weight 

Hair 

Eyes 

Residence 

Employment/Occupation 
Telephone Number 
Driver’s License Number 
and Issuing State 
Education 


Fitzpatrick, Leland Chace 

j(b)(6).(l»(7)(C) 


Unknown 

Unknown 

Unknown 

Unknown 

Unknown 
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CLASSIFICATION: 


FOR OFFICIAL USE ONLY 
LAW ENFORCEMENT SENSITIVE 


WARNING 

This document is the property of the Department of Defense Inspector General and is on 
loan to your agency. Contents may not be disclosed to any party under investigation nor 
may this document be distributed outside the receiving agency without specific prior 
authorization of the Deputy Inspector General for Investigations. 
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EXHIBITS: 

None. 


Prepared by Special Agen( b) E) w ?) ' 


Arlington Resident Agency 


APPR: 


|(bXB).(bJCTXC) 
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NARRATIVE 

1 . This project was initiated based upon information and a request from the DCIS Mid- 
Atlantic Field Office regarding information received from Project Flicker, an 
Immigration and Customs Enforcement (ICE) national undercover investigation into 
commercial child pornography websites. 

2. Project Flicker identified over 5,000 individuals who subscribed to the commercial child 
pornography websites that were targeted by ICE. The names and identifying data on the 
individuals who subscribed to the commercial child pomographyhvebsites were checked 
against the Department of Defense (DoD) databases to identify those individuals who 
were associated with the DoD and subscribing to child pornography. 

3. Child pornography is illegal and subscribers of commercial child pornography that are 
associated with the DoD put the DoD, the military and national security at risk by 
compromising computer systems, military instillations and security clearances to name a 
few. Additionally, it puts the DoD at risk of blackmail, bribery, and threats, especially 
since these individuals typically have access to military instillations. 

4. This investigation developed sufficient information for three (3) Federal Search Warrants 


(subjecd <bK6UbX7),c> 

, one (1) criminal charge (b):6),(b)!7)!C) and one 

(1) arrest (bK6) ' (bK7KC) 



5. As dictated by DCIS Headquarters, this project is canceled. Additionally, a conclusion 
about Management Control Deficiencies could not be made. 
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IDENTITY OF SUBJECTS 


Name: 

Social Security Number: 
Date/Place of Birth: 

Race: 

Sex: 

Height: 

Weight: 

Residence: 

Home Phone Number: 
Driver’s License Number: 
Employment/Occupation: 


1(b)(8), (bX7)(C) 


CLASSIFICATION: 

FOR OFFIC f AL USE ONLY 


WARNING 
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IDENTITY OF SUBJECTS 
Name: 

Social Security Number: 
Date/Place of Birth: 

Race: 

Sex: 

Height: 

Weight: 

Residence: 

Home Phone Number: 
Driver’s License Number: 
Employment/Occupation: 


IWMMPXC) 


CLASSIFICATION: 


FOR OFFICIAL USE ONLY 
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IDENTITY OF SUBJECTS 


Name: 

Social Security Number; 
Date/Place of Birth: 

Race: 

Sex: 

Height: 

Weight: 

Residence: 

Home Phone Number: 
Driver’s License Number: 
Employment/Occupation: 


1(b)(6), (b)(7)(C) 


CLASSIFICATION: 
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IDENTITY OF SUBJECTS 
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Name: 

Social Security Number: j 

Date/Place of Birth: 

Race: 

Sex: 

Height: 

Weight: 

Residence: 

Home Phone Number: 

Driver’s License Number: 

Employment/Occupation: 


CLASSIFICATION: 

^R4>FH€IAt4JSE-ONLY 




20070 1 765V- 1 0-SEP-2007-40D Y- W 1 /Z 


Page 7 of 12 


IDENTITY OF SUBJECTS 


Name: 

Social Security Number: 
Date/Place of Birth: 

Race: 

Sex: 

Height: 

Weight: 

Residence: 

Home Phone Number: 
Driver’s License Number: 
Employment/Occupation: 
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Employment/Occupation: 
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IDENTITY OF SUBJECTS 


Name: 

Social Security Number: 
Date/Place of Birth: 

Race: 

Sex: 

Height: 

Weight: 

Residence: 

Home Phone Number: 
Driver’s License Number: 
Employment/Occupation: 


1(b)(6), mm 


Prepared by SA[ 


(b)(6), (b)(7)(C) 


Dayton RA 
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NARRATIVE 


1. This case was initiated based on information derived from Operation Flicker (UID: 
200701 199X). On May 29, 2007, DCIS initiated Operation Flicker based on a request and 
information provided by Assistant United States Attorney (AUSA) Gerald Smagala, United 
States Attorneys Office (USAO), Eastern District of Virginia (EDVA), Alexandria, VA. AUSA 
Smagala advised that the U.S. Immigration and Customs Enforcement (ICE) was conducting a 
national investigation that identified over 5,000 individuals who allegedly subscribed to 
predicated child pornography websites. AUSA Smagala specifically requested that DCIS assist 
in identifying DoD affiliated individuals among those subscribers. Utilizing the information 
developed by ICE, Christopher Stokes, a U.S. Government employee (GS-1 1) at the National 
Defense University, Norfolk, VA, was identified as a subject who reportedly made two 


purchases from at least one of the predicated child pornogra phy w ebsites. During the course of 
the investigation, it was confirmed th at Stokes re si ded a t: il> ;gK&K7 ’ :ci 


(b)(6), (b)(7)(C) 



2. Evidence collected during the course o f this investigation revealed that on October 1 1 
2006 and again on December 29, 2006, Stokes F™ b)(7)(C) 

1(b)(6), (b)(7)(C) — ' ~~ ' ' “ 


3. On October 11, 2007, DCIS executed a federal search warrant at Stokes’ residence with 
the assistance of ICE and the Norfolk Police Department. During the execution of the warrant, 
numerous items were seized including a computer, hard drive, and numerous compact disks 
(CDs). Stokes was present during the execution of the search warrant and consented to an 
interview. During the interview, Stokes provided a written statement and consented to a search 



4. 



Forensic Analyst, USAO, EDVA, Newport News, VA, performed 


a forensic analysis of various computer related equipment seized during the execution of the 
search warrant. In addition, Special Agent | (b)(6),(bX7 ‘ (C) ICE, Norfolk Office, also examined 


two CDs, which were seized during the execution of the search warrant, confirming that they 


contained images of child pornography. 


5. On April 1 1, 2008, AUSA: ’ b) ™° i(7i ‘ C) | Norfolk Division, Criminal Section, filed a 

Criminal Information with the U.S. District Court, EDVA, Norfolk, VA, which charged Stokes 
with Possession of Material Containing Child Pornography (Title 18, U.S. Code, Section 






i 
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2252(a)(5)(B)) and Criminal Forfeiture (Title 18, U.S. Code, Section 2253). 

6. On May 20, 2008, Stokes pled guilty in U.S. District Court, EDVA, Norfolk to the single 
count Criminal Information filed on April 11, 2008, charging him with Possession of Material 
Containing Child Pornography. As part of his guilty plea, Stokes agreed to forfeit assorted 
computer equipment and digital media which contained and facilitated the viewing of child 
pornography. 

7. On October 24, 2008, pursuant to his guilty plea, Stokes was sentenced by Senior United 
States District Judge Henry Coke Morgan, Jr. in U.S. District Court, EDVA, Norfolk to 60 
months confinement and lifetime supervised release. In addition, Stokes was ordered to 
immediately pay $12,500 in fines, as a $100 Special Assessment had already been paid to the 
court. Additional rules were established concerning Stokes’ supervised release, which are to be 
monitored by his Probation Officer upon his release from confinement. Stokes was allowed to 
remain on bond pending notification of his assignment to a federal penitentiary. 

8. On January 12, 2009, the Final Order of Forfeiture was signed by Senior United States 
District Judge Henry Coke Morgan, Jr., and filed in the U.S. District Court, EDVA, Norfolk. 

9. All investigative and judicial actions have been completed. No fraud vulnerabilities were 
uncovered during the course of this investigation. 

10. This investigation is now closed as finished. 


A-2 




MmnfiTfKfES 


IDENTITY OF SUBJECTS 


IDENTIFYING DATA 


Christopher Michael Stokes 


Name 

Alias 

Social Security Number 

Date/Place of Birth 

Race 

Sex 

Height 

Weight 

Hair 

Eyes 

Residence 


[(b)(8), (b){7XC) 


Employment/Occupation 


Driver’s License Number 


Education 


Prepared by Special Agent 
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NARRATIVE: 

1 . This case was initiated based on information derived from Defense Criminal 
Investigative Service (DCIS) Project: Operation Flicker (Case Control Number 200701 199X). 


2. As background, the DCIS Arlington Resident Agency, initiated Project: Operation 
Flicker based on information provided by Assistant U.S. Attorney (AUSA) Gerald Smagala, U.S. 
Attorney’s Office, Eastern District of Virginia (EDVA), Alexandria Division. AUSA Smagala 
advised that the Immigration and Customs Enforcement (ICE) was conducting a national 
investigation that identified over 5,000 individuals who subscribed to predicated child 
pornography websites. AUSA Smagala specifically requested DCIS assist in identifying DoD 
affiliated individuals and provide investigative assistance. 


3. 



was identified as an employee of Audio Video Systems, 


Incorporated, a DoD contractor. 


.A...... O n August 15. 2007. agents executed a,search.warrantjon| (bX6) ' (b)(7)(C> residence located at 

| Subsequent to the execution of 

the search warrant, agents conducted a non-custodial interview ofp^ ,b)(7)(C) || (bX6Mb>l7)iC) j admitted to 
subscribing to approximately five websites that offered child pornography images7[ (bi(6),(b l(7)( ' er l 
stated he was looking for images of high school age girls. ibX6X(bX7XC> [ admitted to viewing 
pornographic images of individuals under age 18. (b)(6),(b)(7)(C U stated he knew it was wrong. 


5. Due to a lack of resources, this case will be closed. ICE, as the lead investigative agency, 
will be responsible for the final adjudication of this matter. No management control deficiencies 
were identified during this investigation. 


[ 


A-l 




Name 

Alias 

Social Security Number 

Date/Place of Birth 

Race 

Sex 

Height 

Weight 

Hair 

Eyes 

Residence 

Employment/Occupation 
Telephone Number 
Driver’s License Number 
and Issuing State 
Education 



Unknown 

Unknown 

Unknown 

Unknown 

Unknown 
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December 30, 2008 


NARRATIVE: 


1 . This case was initiated based on information derived from D CIS Project: Oper ation 
Flicker (Case Control Number 200701 199X). The project identified 


(b)(6).(b)(7XC) 


former 


U.S. Navy reservist (E-05), as an individual who downloaded child pornography. 


2. As background, Immigration and Customs Enforcement (ICE) initiated an investigation 
into a criminal organization operating a commercial child pornography website known as “Home 
Collection.” The investigation revealed “Home Collection” was operating numerous commercial 
child pornography websites. In addition, the organization utilized various PayPal accounts to 
process the payments for access to the member-restricted websites. Assistant United States 
Attorney (AUSA) Gerald Smagala, Eastern District of Virginia, requested DCIS assist in 
identifying individuals affiliated with the DoD and provide investigative assistance. In response, 
the DCIS Arlington Resident Agency (RA) initiated Operation Flicker. 

3. The criminal organization utilized a specific and identifiable payment website known as 
“iWest.” The information developed during the course of the investigation identified that the 
organization (1) used various PayPal accounts to facilitate the customer payments; (2) used 
specific subject identifiers within the PayPal accounts to identify purchases of subscriptions to 
various member restricted websites; and (3) used specific administrative e-mail accounts that 
were used to distribute access to the member restricted websites. 


4. 


SA 


IMWWXC) 


DCIS Arlington RA, utilized information contained within the 
DoD Employee Interactive Data System and the Joint Personnel Adjudication Systems (JPAS) to 
identify DoD personnel and contract employees who joined the member restricted sites. Among 
those identified was 


|(bX6).(b)(7)(C) 


5. On A ugust 29, 2007, DCIS and ICE executed a search warrant at 


(b)(6). (b)(7)(C) 


(b)(6), (bX7)(C) 


based on evidence 


(b)(6), (b)(7)(C) 


(b)(6), (b)(7)(C) 


resided there. Upon entry, lt was determined 


no longer resided there. The occupants related 


address. It was later determined 

|(bX6);(b)(7xc) ] 


(bX6),(bX7XC) 


(b)(6), (b)(7)(C) 


continued to receive mail at that 


new address W as (bX6,,(b)(7, . <c) 


6. On August 29, 2007, SA 

(bX6), (b)(7)(C) 

interviewed 

( b x 6 ), (b)(7)(c) owner of the property at 

(b)(6), (bX?XC) 


(b)(6), (b)(7)(C) 

(rented a room at 

(b)(6), (b)(7)(C) 

Drive for over a year. During his occupancy, <b)(6)(b)(7)(C) 

had three roommates, 

(b)(6), (b)(7)(C) 


(b)(6), (b)(7)(C) 




««»,.»« ^ movedouto f^ 

jon February 1, 

2007 pwwx'HC) 

| informed 

(b)(6), (bX7)(C) 

he was moving to find cheaper rent. 

(b)(6).(b)(7xc) Relieved 


Iwas a| 

b)(6), (b)(7)(C) ; 

(b)(6), (b)(7)(C) 

at Fair Oaks Mall, Fairfax, VA. 


7. On August 29, 2007, 
Commission, provided SA| 


(b)(6), (b)(7) 
[(C) 



Information Control Officer, Virginia Employment 
employme nt data . Quirk informed 


<b)(6).(b;<7)'C) 


contacted 


kb)(6), (b)(7)(C) 


in Fair Oaks Mall and 


A-l 
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December 30, 2008 


was informed 


|(bXS),(b){7KO) 


(b)(e),(b)(7)(C) 


no longer worked there . Instead, he was employed at 


(b X 6).(b)(7 X C) 


Tyson’s Corner Center Mall, McLean, VA. 


8. On November 30, 2007 SAs ' bX6UbX7XC> 

DCIS Arlington RA, interviewed 

(B)(6), (bX7)(C) 

The interview took place in the 1 

)b)(B). (b)(7)(C) 

in Tyson’s 

Comer Center Mall. During the interview 

j (bxe), ( b X 7)(c) gave"SAs <bX6, ' (b!(7)(C) 

consent to 

search his personally owned computer for forensic analysis. (b)(6)(b)(7XC) 

guided SAs 

(b)(6), (b) 
<7)(C) 

and 

(b)(6,.(b X 7)(c) to his residence a1 (bX6) ' (b)(7XC> 








Once at his residence, [ (b Xb),(bK o;c) informed SAsf 
the child pornography website Desired Angles. 
website were definitely underage. Aftei (b)(6) ' (b>t7>co> 


|(b)(B), (b)(7)(C) 

■ 


1(b)(6), (b)(7XC) 


he paid $50 to access 


informed the nude children on the 


visited the website once and viewed the child 

did 


(b)(6), (b)(7)(C) 


pornography, he decided it was not what he expected and did not access it again. 

not download the child pornography. Furthermore, 1 ;5>6!1:jX7KcT | stated his computer might contain 
images of underage girls wearing clothes. 

9. On April 30, 2008, SA Thomas provided one co mp act disc (CD) containing images 


SA 


(b)(6), (bX7)(C) 


found on 


(b)(6), (b)(7)(C) 


(b)(6), (b)(7)(C) 


United States Postal Inspection 


computer to Inspector 

Service, National Center forMissing and Exploit ed Ch ildren (NCMEC), 699 Prince Street, 

examine the CD for known child 


Alexandria, VA 
victims. 


SA 


(bX6).(b)(7)(C) 


requested Inspector D: e: :t 7; 


1(C) 


10. On June 18, 2008j 
NCMEC, analyzed 


(b)(6), (bX7)(C) 


j(b)(6),(b)(7XC) 


Child Victim Identification Program, 
computer and identified several files that appeared to contain 


images of child victims law enforcement previously identified. 


11. On July 23, 2008, SAp' 6l(b,(71(C) DCIS Arlington RA, reviewed the images NCMEC 
identified and concluded all images were found in “free space.” On October 20, 2008, 

SA Carson completed a final media analysis that concluded all images were carved from “free 
space.” 


12. On June 28, 2008, SAP 


(b)(6). (bX7)(C) 


analyzed 


1(b)(6), (b)(7)(C) 


Internet search logs and visited each 


website. Although many websites advertised teen and child models, no websites advertised child 
pornography. 


13. On July 28, 2008, AUSA Smagala declined prosecution on the matter. AUSA Smagala 
advised he did not intend to prosecutej (bl(6) ' (bi(7XC) j because the images NCMEC identified were in 


“free space.” AUSA Smagala explained items in “free space” do not constitute possession. 


14. No judicial or administrative action will occur. No fraud vulnerabilities were identified 

during this investigation. DCIS will take no further action on this matter. The investigation is 
closed as “declined.” 
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NARRATIVE: 


1 . On October 8, 2008 
contract employee with 


(b)(6), (b)(?XC) 


1(b)(6), (b)(7)(C) 


a National Reconnaissance Office (NRO), 
was interviewed by the Personnel Security Division 


1(b)(6), (b)(7)(C) 


(PSD), NRO, regarding the renewal of his security clearance. During this interview 
admitted to being addicted to pornography and that he viewed child pornography about twice a 
week from his home computer j (bK6) ' (b)(7 )(C ) stated he finds child pornography on the internet by 


using an internet search engine to search for terms such as “underage” or “underage model.” 


(feX6).(6K7) 

EL 


further stated he has joined pay for view web sites depicting children in nude or nearly nude 


photos and videos. 


Investigator (INV) 


wmwfwr 


NRO, Office of the Inspector General (OIG), 
reported that the NRO PSD was prompted to address this specific topic of trafficking in child 


J(b)(6), (b)(7) 


(B)(6), (b)(7)(C) 

(b)(6), (b)(7) 


(C) 


(bX6), (b)(7) 
(C) 


who was also a contract NRO employee, and was residing with 
|at the time, reported she had discovered evidence on his computer that he was in possession 
confronted! 


of child porn ography. 
pornography. 


(b)(6), (bX7) 
(C) 


(b)(6), (bX7) | 

EL 


(bX6),(bX7) 

(c; 


and he confessed to knowingly possessing the child 
had reported this matter to the Personnel Security Division; however, the 

next personnel security update. 


decision was made internally to only address the issue at£f Ub)(7) 


(bX6). (b)(7) 
1(C) 


NRO OIG had only received this information afteii(c) 6) ' <b,(0 

inM 


confes sion dur ing his PSD interview. 


(b)(6), (b)(7) 

Ga 


indicating thatf’ i6),(b)!7i 


(Cl... 


was 


further received copies of credit card statements from| 
possibly using his credit cards to pay for pornographic internet memberships. Legal processes were 
issued in order to establish probable cause for a search ofj[g ) f6 ) ' (b)17) | residence and computer. 


3. On June 9, 2009, SA 


((>!((>), (b)(7)(C) 


coordinated with Assistant U.S. Attorney 


Jerry Smagala, U.S. Attorney’s Office, Eastern District of Virginia, Alexandria, VA, who stated no 
records were available concerning the aforementioned credit cards statements. 


4. On July 22, 2009, SA fcf !i3i(7! was contacted by INV; 


(b)(6), (b)(7) 
(C) 


who reported|£f X!b)(7) (had 


permanently relocated to a NRO facility in New Mexico and was currently residing at 


(b)(6), (b)(7XC) 


(b)(6), (b)(7)(C) 


5. 


As 


(b)(6), (b)(7)- 
<C) 


(currently worked and resided in New Mexico, the Arlington Resident 
Agency referred this matter to the DCIS South West Field Office (S WFO). The matter was briefed 

.1(b)(6), (b)(7)(C) 


to Resident Agent in Charge 


by Acting Computer Crimes Coordinatorj (b)(6),(b)(7)(C) 
on August 1 1, 2009. The matter was referred to the SWFO under Information Report 200902497C- 
1 0-SEP-2009-60DC- W 1 /R. 
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2008017740-16-JUL-2008-30TL-Z1/F 

NARRATIVE 


April 9, 2009 


1. On July 10, 2008, the Defense Criminal Investigative Service (DCIS), Tulsa Resident 
Agency, received a formal request from Assistant United States Attorney (AUSA)] 


|(bj(6) 1 <b)(7)(Cj 


Chief, Criminal Division, Eastern District of Oklahoma, to assist in the Federal investigation of 
Kris A. Ledford. It was alleged that Ledford, a Muskogee police officer, stole firearms from the 
Muskogee police evidence room, impersonated a Tulsa police officer and stole a police issued 
bullet proof vest from a co-worker. AUSA Horn requested the DCIS assist in helping determine 
Ledford’s military service record. Ledford’s counsel had proclaimed in the local media that 
Ledford served in the U.S. military as a sniper and was awarded the Purple Heart and Bronze 
Star along with other commendations and that Ledford suffers from Post Traumatic Stress 
Disorder (PTSD). 



5. On September 2, 2008, the RA obt ained a copy Ledford’s military personnel file from 
National Personnel Records Center. 


(b)(6), (b)(7)(C) 
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RbXSftbjpxc) 


who was 


meubmo) 


stated he was the[ W(6),(b)(7)(C) 


6. On Septe mber 16 , 2008 the reporting agent interviewed ' 

the forme r l (bX8)(by7>( C> _____ _ 1 1 st Battalion, 36 th Infantry Regiment. 

1 st Battalion, 36 th Infantry Regiment, during 
* (b)<7) ‘ 0) stated he remembered deploying to 
| stated Ledford did not receive a 

Bronze Star or Purple Heart for ac tion during the deployment | (b)t6) (b)(7)(C) i stated he 
specifically recalls Ledford due to 

P(6),(b)(7)(C) 


which time Ledford was assigned to the unit. 

Bosnia with Ledford being assigned to this unit. 


(h)(6), (b)(7)(C) 


7. On October 1, 2008, the RA obtained records from the U.S. Department of Veteran 
Affairs concerning Kris A. Ledford. 

[(b)(6), (b)(7)(C) — I 


(b)(6), (b)(7)(C) 


8. On November 12, 2008, Kris Ledford was charged by way of a criminal Information for 
violating Title 18 United States Code § 922(j) Possession of Stolen Firearm and Title 18 United 
States Code § 704 Stolen Valor. The information charges that on or about June 4, 2007 to on or 
about May 29, 2008, Ledford knowingly possessed, concealed, stored, bartered, sold and 
disposed of nine stolen firearms. The Information also charges that on or about July 23, 2008, 
Ledford falsely represented himself, verbally and in writing, to have been awarded the Purple 
Heart and the Bronze Star. 

9. On November 19, 2008, Kris Ledford pled guilty in U.S. District Court for the Eastern 
District of Oklahoma to a one count violation of Title 1 8 United States Code § 922(j) Possession 
of Stolen Firearm and to a one count violation of Title 1 8 United States Code § 704 Stolen Valor. 

1 0. On March 3 1 , 2008, Kris Ledford was sentenced in U.S. District Court for the Eastern 
District of Oklahoma to 48 months imprisonment and ordered to pay a special assessment of 
$100 for one count violation of Title 18 United States Code § 922(j) Possession of Stolen 
Firearm and sentenced to 12 months imprisonment and ordered to pay a special assessment of 
$25 for one count violation of Title 18 United States Code § 704 Stolen Valor. 

11. All adjudication has been completed and no further action is anticipated. This 
investigation is complete and will be closed. There were no fraud vulnerabilities identified 
during the course of this investigation. 
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Employment/Occupation 
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Education 


IDENTIFYING DATA: 


Kris Allen Ledford 



Police Officer 


Muskogee Police Department 

|(bX6).(bX7XC) I 
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October 21, 2008 


NARRATIVE 


1 . This investigation was initiated based upon based on information derived from a DCIS 
Project, Operation Flicker, Case Control Number 200701 199X. As background, on May 29, 
2007, DCIS initiated Operation Flicker based on information provided by Assistant United States 
Attorney (AUSA) Gerald Smagala, United States Attorney’s Office, Eastern District of Virginia, 
Alexandria Division. AUSA Smagala advised that Immigration and Customs Enforcement (ICE) 
was conducting a national investigation that identified over 5,000 individuals who subscribed to 
predicated child pornography websites. AUSA Smagala specifically requested that DCIS assist 
in identifying DoD affiliated individuals and provide investigative assistance. The reporting 
agent utilized information contained within the DoD Employee Interactive Data System and the 
Joint Personnel Adjudication Systems (JPA S) to identify DoD af filiated individuals. Among 


those identified was Stanley P. Demoulin, af 


(b)(6), (b)(7)(C) 


DoD contractor employee at the 


Natio nal Se cur ity Agen cy. A query of JPAS revealed that D emoulin 


mmMom 


(b)(6), (b)(7)(C) 


Under Operation Flicker, Demoulin 
made approximately four purchases of alleged pornographic material depicting children. Exhibit 
1 is a copy of the DCIS Form 1, “Case Initiation”, dated October 3, 2007. 


2. On October 17, 2007, a search warrant was executed on DeMoulin’s residence in 
Odenton, MD. Numerous computer-related and other items were seized from the residence. 
Exhibit 2 is a copy of the DCIS Form 1, “Significant Incident Report/Search Warrant”, dated 
October 22, 2007. 


3. Analysis of DeMoulin’s computer files indicated evidence of child pornography. After 
negotiations with DeMoulin and his attorney, on April 15, 2008, DeMoulin agreed to plead 
guilty to a Criminal Information charging him with Receipt of Child Pornography, Title 18 USC 
§2252A(a)(2)(A) & Title 18 USC §2256. Exhibit 3 is a copy of the DCIS Form 1, “Plea 
Agreement”, dated May 29, 2008, and Exhibit 4 is a copy of the DCIS Form 1, “Criminal 
Information”, dated May 29, 2008. 

4. On July 11, 2008, DeMoulin pleaded guilty in U.S. District Court, Baltimore, MD, to 
violating one count of Receipt of Child Pornography, Title 18 USC §2252A(a)(2)(A) & Title 18 
USC §2256. On August 28, 2008, DeMoulin was sentenced to 63 months in prison, a $100 
assessment, sentenced to lifetime probation, and ordered to register as a sexual offender upon 
release from prison. Exhibit 5 is a copy of the DCIS Form 1, “Guilty Plea”, dated July 1 1, 2008, 
and Exhibit 6 is a copy of the DCIS Form 1 , “Sentencing”, dated August 28, 2008. 

5. No fraud vulnerability reports were completed during the course of this investigation. 
All investigative effort is now complete. This investigation is closed as “finished” with the 
submission of this report. 
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IDENTIFYING DATA 

Name 
Alias 

Social Security Number 
Date/Place of Birth 
Race 
Sex 
Height 
Weight 
Hair 
Eyes 

Residence 

Employment/Occupation 


Home: UNKNOWN 

Office: UNKNOWN 

[If appropriate] Cell: UNKNOWN 

UNKNOWN 

UNKNOWN 


Telephone Number 


Driver’s License Number 
and Issuing State 
Education 


Stanley P. DeMoulm 



: 




| 
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EXHIBITS 

1 - DCIS Form 1, “Case Initiation”, dated October 3, 2007. 

2 - DCIS Form 1, “Significant Incident Report/Search Warrant”, dated October 22, 2007. 

3 - DCIS Form 1, “Plea Agreement”, dated May 29, 2008. 

4 - DCIS Form 1, “Criminal Information”, dated May 29, 2008. 

5 - DCIS Form 1, “Guilty Plea”, dated July 11, 2008. 

6 - DCIS Form 1, “Sentencing”, dated August 28, 2008. 
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Baltimore Resident Agency 
C-l 


APPR: 


[M6Mt>M7XC> 


CLASSIFICATION: 


WARNING 

; It the prop erty of the Department of Defense Inspector General and Is mi Jasa to 
your agency. Contentg-mav-net-ba -rilaclosed to an<u iartv-4in<farin7gsn5aIloT nor may this 
docu ment be dlgtribut 3fU:uj?&fe,H^ p rior authorization of the 

-Deputy inspector General for Investigations. 






(Investigations) 


INSPECTOR GENERAL 
DEPARTMENT OF DEFENSE 
DEFENSE CRIMINAL INVESTIGATIVE SERVICE 
TULSA RESIDENT AGENCY ■, ■ 

1603 S. 101ST EAST AVENUE, STE 131 
TULSA, OK 74128 


20090111 7N-1 8-M AR-2009-30TL-W 1/D January 7, 2010 



CASE TERMINATION - CLOSED : This investigation was initiated pursuant to a 
formal request from the U.S. Immigration and Custom Enforcement (ICE) to assist in the Federal 
investigation of <bM!b,(7> ' C) j It was alleged that (b > (6) ' ib)(7!(C) a civilian employee with the U.S. 

Army at Fort Sill, OK, downloaded child pornography. On December 29, 2008, ICE Cyber 
Crimes Center received notification from Bundeskriminalamt (BKA), the German Federal 
Criminal Office, concerning the distribution of child pornography via the file sharing system 
known as Gnutella. 


Specifically, the BKA advised that on December 17, 2008, their Computer Crime Unit 
conducted a search/analysis for child pornography in the Gnutella file-sharing network. Analysis 
of the logged data streams reflected a file containing child pornography had been received from 

ie of the suspects was identified as using the IP address 
to AT&T Internet Services. ICE requested the subscriber 
information from AT&T Internet Services for the user logged in to that IP address on the noted 


different sources/suspects. Or 
r™ 1 which belongs 


spe cific dat e and time. AT&T informed ICE that the user account logged on to IP address 


l (b)(6),(b)(7KC) on ^ a k ove p stec i date and time was subscribed to 
service address ofl (b)i6) ' (b)(7XC1 


■ MS).(t>X7)(C) 


An on-line search fo r[ (b X6iXbX7i(C) in sta te of Oklahoma conducted by ICE revealed an 
e-mail address of (bX6Ub)(7)fC) j ICE then contacted the Defense Criminal 

Investi gative Service (DCIS) for assistance in helping determine the further identify of |jci (6) ' ib)l7) 
;bX6),(b)(7xc) dqs j u i sa Resident Agency conducted a Department of Defense Employee 
Interactive Data System query, which determined| (bK6)l(b)(7)(Ci |to be a GS-7 Army Civilian working 

for the U.S. Army Medical Command with a home address 0 f (a)(61 - (bl(7)(C) 

amr 1 1 This was the same address documented in the AT&T service address. An on-line query of 
“amedd” listed in the e-mail address provided by ICE revealed it was an abbre viation for Arm y 
Medical Department. A Reenlistment Eligibility Data Display query revealed <bX<i>(bX7>lC) 

l(bX6).(b)(7)(c) — 
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forensic examination of the computer, approximately five thumbnail images were discovered 
from the Thumbs.db file of the media player. These images appeared to be the initial frame of 
deleted video files, which depicted the sexual abuse of minor children. 


On July 13, 2009, ICE Special Agents’s 

lotlwa/ll^^'tbJ^XC) I xx^oix/orl Ixio olrrlxfo *x*x/4 


(b)(6).(b)(7)(C) 


and 


(b)(6), (b)(7)(C) 


both 

interviewed^ 6 ’ lD,(7)(0) J who waived his rights and^pfovided the following information. [ (bXr ” XbX ' ,(C) 
was shown the thumbnail images o f videos that had been deleted from his computer and was 
asked if he downloaded the videos. | <bX8),<b>(7)(C> 'l stated that he did and that he used Limewire to 

1(b)(6), (b)(7)(C) 


download them. 


terms he would have used to find them, 
was downloaded by the BKA. 


did not remember watching them nor did he remember the exact search 
was also shown a portion of the video which 


(b)(6), (b)(7)(C) 


(b)(6), (bX7)(C) 


he did not recall ever seeing a video of her or downloading one. 
would download videos and then immediately delete them. 


stated that he has seen pictures of the minor female, but 

stated that he usually 


(b)(6), (b)(7)(C) 


On July 14, 2009, Assistant U.S. Attorney (AUSA) 


investigative findings and AUSA|$y 


l(bX6).(b)(7)(C) 


was briefed on the 


(declined prosecution. Subsequently, the reporting agent 

(b)(6), (b)(7)(C) — ) oftheFort 


provided all investigative findings to Special Agent in Charge 
Lawton U.S. Army Criminal Investigation Command office, who briefer <b)<6)(b)(7KC> 
commander on the investigative findings. 


unit 


The final report of investigation prepared by ICE is attached. This investigation is being 
closed as no further investigative activity is anticipated. There were no fraud vulnerability 
reports identified during the course of this investigation. 


Attachment: 

1. ICE Report of Investigation # OC07QR090C0006 dated July 14, 2009. 
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NARRATIVE: 


JL This investigation was initiated based upon information received from| (b)(6),(b)(7>(C> 

(b)(6), (bypKo [ Security and Intelligence Directorate, Defense Advanced Research Projects 

Agency (DARPA), Arling ton , VA, concerning possible possession of child pornography by 


(b)(6), (b)(7)(C) 


Program Manager, DARPA, Arlington, VA. 


(b)(6), <b}(7)(C> 


indicated that on June 23, 2003, during a routine check ofj <b)(tl) ' ltl>(7>(C) [work 


computer for a virus. 


1(b)(6), (b)(7)(C) 


a contractor from DARPA’ s Information 


Technology Division, Arlington, VA, discovered what appeared to be child pornography. 


3. On June 24, 2003, 


(b)(6), (b)(7)(C) 


(b)(6).(b)(7)(C) 


who is the| (b)(6>,(b)!7)(0) 


(b)(6), (b)(7)(C) 


Defense Criminal 


was interviewed by Special Agent (SA)[ 

Investigative Service (DCIS), Mid-Atlantic Field Office (MAFO), and advised that on June 23, 
2003, he was approached by[ (b)(S)l(b)i7i(Cl a network engineer, who stated that he 


had found a large amount of pornography on 


: (b)(6), (b)(7)(C) 


computer during the process of reviewing 


the file system for a virus that had been reported by the network virus scanning software. 

immediate supervisor, P >K6>,<b)(7)<ci 


(b)(6), (b)(7)(C) 


called 


(b)(6), (b)(7)(C) 


who came over to 


examine the images. Whilc < " >(S) ' :a>r/ ' :c; and ib)<6) '* b)(7 ’* E ‘ ’jwere showing the images tofjf 6),ib ’ !7 ’ | they 
discovered images that appeared to be child pornography. i=,(6 ' ,!b ’‘ 75fe) 


and 


i(b)(6), (b)(7)(C) 


(b)(6), (b)(7) 

[(CL 


then directed 

to copy the portions of the file system fromP 6),(b)(7)(C) jhard drive that contained the 

provided DCIS with a series of CD-ROMs containing the pornography 


(b)(6), (b)(7)(C) 


pornography, 
copied fr 0 m[ <blt6) ' (b)(7)i<S) [computer. 


4. On July 15, 2003, SA| <bK6,,(b)<7)!C) . DCIS-MAFO, began an analysis of the images 

provided by DARPA. Images that contained potential child pornography were identified and 
provided to the National Center for Missing and Exploited Children (NCMEC) to determine 
whether the individuals contained in the images could be identified as known victims. 
Routinely, in order to criminally prosecute child pornography cases through the Federal system, 
individuals in the images must be identified as known victims. 


5. On October 31, 2003, the NCMEC reported that no known victims were found in the 
images provided for their review. 


1(b)(6), (b)(7)(C) 


u.s. 


6. On November 3, 2003, Assistant United States Attorney (AUSA)[ (: 

Attorney’s Office, Eastern District of Virginia, Alexandria, VA, declined to criminally prosecute 
this matter given that there were no images of known victims. 
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7. On December 15, 2003, 


(bite), (bxnier 


Criminal Investigator, Computer Crime Unit, 


Office of the Attorney General, Commonwealth of Virginia, Richmond, VA, was contacted and 

stated that under 


provided with a copy of t he DCIS-MAFO media analysis report. 
Virginia statutes:[cf'"’ i(7) ] could be prosecuted by the Commonwe 


(b)(6), (b)(7)(C) 


[could be prosecuted by the Commonwealth under § 1 8.2-374. 1:1, 
Possession of Child Pornography; which would be a class 5 felony. Virginia s tatut e does not 
require that the individuals in the images be identified as known victims, [msTmpkc) j stated his 


office would open an investigation and contact a Commonwealth’s Attorney to prosecute this 
matter. 


On February 27, 2004,|Tf (7) 


was interviewed by SA 


(b)(6), (b)(7) 
(C) 


and 


(b)(6), (b)(7)(C) 


8 . 

confessed to downloading pornography both from his residential and his office computers; 
however, he denied specifically targeting any child pornography for downloadjsee Exhibit 1). 

gave consent 


(b)(6), (b)(7) 
(C) 


1 [provided a written statement concerning his activity (see Exhibit 2) 


(b)(6), (b)(7) 

<9L 


for the search of his residential computers and his office notebook. 


9. 


On April 7, 2004, the media received fromj[c) <6|,<b)<7> 


were provided to the Defense 


Computer Forensics Lab (DCFL) for analysis. 


1 0. On September 22, 2004, the DCFL completed their analysis of the material received from 
A review of the report revealed a large amount of pornographic material that might meet 


(b)(6), (b)(7)(C) 


the definition of child pornography. A copy of the DCFL report was provided to’ 


[(b)(6), (b)(7)(C) 


1 1 . This Report of Investigation is being provided to DARPA for information purposes and 
action as deemed appropriate. Should administrative acti on b e ta ken, it is reques ted that SA 


(b)(6), (b)(7) 
(C) 


be notified. 


electronic mail address o 



can be contacted alj (b>l 
dodig.osd.mil . 


or at the 


12. Possible images of child pornography and other pornographic images obtained during the 
course of this investigation cannot be appended to this report due to their graphic nature and, in 
regards to the possible images of child pornography, their classificatio n as cont raband. Should 
additional information about the images be needed, please contact SAp Wb5? ^ ] 

13. Based on information obtained to date, the DCIS-MAFO will continue to work with the 
Commonwealth of Virginia in seeking possible criminal prosecution of^f 
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IDENTIFYING DATA 


Name 

Social Security Number 
Date/Place of Birth 
Race 
Sex 
Height 
Weight 
Hair 
Eyes 

Residence 

Employment/Occupation 

Defense Advanced Research Projects Agency 
Arlington, VA 
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NARRATIVE: 


This case was initiated based on a referral from the Defense Protective Service (DPS), 
mtagon Force Protection Service (PFPA), on Mav 16, 2002. SA^ b><6),(bK7)(C ’ 1 DPS 


advised SA (b,(6, ' (b,(7KC) 

Arlington Resident Agency (RA), that (b)(6) ' (b,<7,(C) 

(b)(6),(b)(7)(C) 

[Management Support Division, Navy Annex, Washington, DC, 


used his assigned government computer to access pornographic websites and download material 
that appeared to be child pornography. 


2. As background, on May 15, 2002, SA | (b>(6),(b)(7)(5r [ interviewed[ (b>( 6),(b)(7 ~ >I5 T Network 

Security Administrator, Dyncorp Incorporated (Dyncorp). As part of computer virus protection 
efforts, Dyncorp was under contract to the Information Technology Division (ITD), Real Estate 
and Facilities Directorate (REFD), Washington Headquarters Services, to track computer 
viruses. According tc (b>( 6>, < b>(7)(C) on ]VI a y 10, 2002, he performed a McAfee virus scan of the 
network of the REFD at the Pentagon and Navy An nex. The software created an “E-Policy” 
report of the top ten computers affected by viruses. (bi(6Wb)(7)(C> computer was number one with 
218 viruses detected. 


3. ‘Mvxwjm j crea t ec j a “S QUID User Access Report” w'hich captured ever)' instance of 

internet access. <b)<6)<b)(7KC) jprovided the E-Policy report and the Squid report to Alex 
Benton, Network Security Manger, Dyncorp. 


4. On May 1 5, 2002, SA“™ ’ ! interviewed M According togf !c,: " | she used the 
SQID User Access Report to review websites (b);6 (b)(7)(C ’ [visited to identify potential sources of 
the viruses. }cf ) ' fb)(7) accessed several of the sites listed in the SQUID report and noticed nude 
images of women and what she believed to be prepubescent girls. ji b f )V(b)(7) informed supervisors 

P" KC) lan d !8)l9uw,7l(C) “■ • The matter was 

pre sented tcf™ )(C) I REFD, I'FD, an d| <b)( “ <C) ~ ~ " 1 

|( b M(b)(7)(C) | refD. Collectively, a decision was made to disable <b)(8),(b)(7XC) account to make it 

impossible for him to logon to the network. 


5. On May 1 5, 2 002, (b>(6i ' (b)(7)<c> to covertly secure| <b><6> ' (b)<7><C) [government computer (CPU), 
disabled <bK6,tb,</xc ' ) account so he couldh’t logon to the network. Once the helpdesk received 

(we), (b)(7)(c) ca ii f or assistance, his CPU was retrieved and replaced with another under the ruse 

of a technical difficulty or CPU problem. ITD transferred the CPU to DPS to create a forensic 
image of the hard drive and maintain as evidence. On May 20, 2002, DPS transferred the CPU 
to the Arlington RA for analysis. 


6. On June 7, 2002, SA <bK6><b)<7)<0) DCIS Arlington RA, High Technology Crimes Team 
(HTCT), conducted an interim forensic media analysis of the retrieved CPU and reviewed 
(b)(6). (b)(7)(C) SQUID report. SA^’* bX7> |recovered 75 images and internet artifacts (index.dat 

files) from the CPU. Analysis of the recovered internet artifacts verified (l,!!<3WbX0(C) ivisited 
prohibited sites such as www.crazy-lola.com , www.cyber-lolita.com, www.x-lolitas.com , and 
www.topless-lolita.com. 
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Assistant United States Attorney (AUSA), 


(b)(6), (b)(7)(C) 


Eastern District of Virginia, 


accepted the case for prosecution. On June 25, 2002, the Arlington RA executed search warrants 
at the following locations belonging toj®^ bS<7 ’ (C) | work area, home and network directories, 

network email archive, and his personal America OnLine (AOL) account. The Arlington RA 

also conducted a consent search of his residence atP 

■ ] 


(b)(6), (b)(7)(C) 


8. Contemporaneous to the searchJ (b><6) ' (b)(7)(C) 
his misuse of the government computer, 
download child pornography. 




(b)(6), (b)(7)(C) 


provided a sworn statement acknowledging 
stated he did not knowingly search and 


explained while intentionally viewing and 


downloading adult pornography, he was redirected to websites containing child pornography. 

9. On September 23, 2002, the Directorate for Personnel and Security, Labor and 
Management Employee Relations Division, Washington Headquarters Services, DoD, issued a 
memorandum of final decision to remove 


(b)(6), (b)(7)(C) 


from employment with the Department of 
Defense (DoD). The agreement detailed a five year employment separation from DoD, which at 
its conclusion was to be expunged from 


(b)(6), (b)(7)(C) 


Official Personnel File and related 


databases. The removal was effective September 24, 2002. 


10. SA 


(b)(6), (b)(7)(C) 


(b)(6), (b)(7)(C) 


IDCIS, Baltimore RA, 


Arlington RA, and SA|' 
who was assigned to the FBI’s Mid - Atlantic Child Exploitation Task Force (MACET), sent 
images recovered from| (b)<S),(b)<7)(C) jCPU to three different agencies in an attempt to identify 
known victims. On October 7, 2002, the FBI reported no known victims were identified. On 
April 23, 2003, the National Center for Missing Exploited Children’s Child Recognition and 
Identification System (CRIS) reported no known victims were identified. On June 24, 2003, the 
Cyber Crime Smuggling Center, U.S. Customs Service, DHS, reported no known victims were 
identified. 


11. In August 2003, due to the federal requirements regarding child pornography 
prosecutions, the case was presented to the Office of the Attorney General, Commonwealth of 
Virginia. The Arlington RA presented the recovered images for review to SA[ (I 


1(b)(6), (b)(7)(C) 


Office of the Attorney General’s Computer Crime Unit, Richmond, Virginia. The Arlington RA 
did not r ece ive a response for a substantial amount of time. While waiting for a response from 
S^(bK7) <c) | s ^(b)(6), (bjf?) |p roceec j ec j t0 yeri A 1 (b)( 6>,( li7)(C ) j employment status, whereabouts, and 


close the case. 


12. In the spring of 2005, SAp (6>,(b)(7>(C| I contacted S A (b)(6>,(b)(7)<cT l and informed him that; 


f(Bx6)Tb!(7)(C) 


fb)W(F) 

mi 


accepted the case for prosecution. SA(c) 6),<b><7) 


was seized at the subject’s residence, work area, and network directories. S/ji 


Computer Crime Unit, Commonwealth of Virginia, 
imaged and reviewed the electr onic me dia that 

copied 


<b)(6).(b)(7; 
|<C) 


recovered images and movies to a compact disk then submitted the compact disk to NCMEC on 
April 22, 2005, for review. NCMEC, which had expanded its CRIS dat abase of k n own victims 

since 2003, identified six “series” of known child victims. Additional ly, (b)(6> ' ib)(7iici 

NCMEC analyst, identified one image that contained an unknown child. 
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NARRATIVE 


This investigation was initiated based upon a request from SA !b!!6),(b,!7J!0) Federal 


Bureau of Investigation (FBI), EauClaire, WI, relative to allegat ions o f distribution of ch ild 
pornography against Ronald Shankey. Computer logins by 


(bX6).(bK7XC) 


in 


January and February 2004, were confirme d by ACS Government Solutions and the U. S. Army 


ffbX6HbX7XC) 


That UserlD was ass ign ed to Ronald 


that the communications were from UserlD 

Shankey. Logins originated from phone numbersf D)<8)!bX7XC> •jand !Di(6 '' (bi!7 ' iC) | Shankey 

was the First Sergeant for the Minneapolis Recruiting Company, Minneapolis Recruiting 
Battalion, U.S. Army Recruiting Command (USAREC) for about one year prior to his retirement 
on August 31, 2004. Shankey was then hired as a civilian contractor for MPR1, a subsidiary of 
DOD Top 100 Contractor L-3 Communications, providing personal services under contract with 
the USAREC, Ft. Knox, KY. He acted in the capacity of a military enlistment counselor since 
the middle of February 2005. Nu merous image s of child pornography were posted to 

by someone using the e-mail address 


(b)(6), (b)(7XC) 


(bX6),(b)(7KC) 

numbef )(6MbX7)<C) 
froixi 
at) 


'(b)C6), (b)(7)(C) 


|(bX6),(b)(7XC) 


Using Yahoo ID information, hotmail e-mail address, and IP 
associated with the postings, the login was made via a dial in connection 
-J Th is ph on e nu mber is the residence number belonging to ( 


1(b)(6), (b)(7)(C) 


[fbX6),(bX7) 

(C) 


WI zip code 54016, ffonP rub)!7XC) 


The e-mail address was registered bj|| 


|(bX6).(bX7) 
iEl 


bn 01/09/2002 with a birth year of 1965. This 


case was worked jointly with the FBI at EauClaire, WI and the St. Croix Sheriffs Office. 


2. Shankey was interviewed on May 17, 2005 and while initially denying knowledge of or 
involvement with child pornography, Shankey later became emotional and requested a lawyer 
before discussing details of his activities. A search warrant was executed at Shankey’s residence 
also on May 17, 2005 and two computers were among the items seized. Shankey’s work 
computer was provided by the U.S. Army Recruiting Command and is being analyzed. Logs of 
Shankey’s computer activity were obtained from the Recruiting Command. Shankey resigned 
his position as a civilian contractor without returning to work. Pornographic images obtained 
from Shankey’s computers were submitted to the National Center for Missing and Exploited 
Children (NCM EC) for comparison with previously iden tified victims of child pornography with 


negative results. 


|(bX6).(bX7XC) 


I were interviewed bv St. Croix County 


(bXS), (b)(7)(C) 


3. The FBI - EauClaire developed information that child pornography was being stored at the 
Shankey residence. A search warrant was obtained and executed on September 7, 2006 which yielded 
numerous items of child pornography. On October 4, 2006, a grand jury for the Western District of 
Wisconsin, Madison, Wisconsin returned a two-count indictment with distributing a visual depiction of 
minors engaging in sexually explicit conduct, and possessing a computer hard drive containing such 
visual depictions. 
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4. On May 1 5, 2007, District Judge John C. Shabaz, for the Western District of Wisconsin, 
Madison, Wisconsin sentenced Shankey on one count of violating Title 1 8, United States Code 
Section 2252(a)(4)(B), Possession of Child Pornography; a Class C felony, a second count of 
distribution of child pornography was dismissed. Shankey was sentenced to a period of 
imprisonment of 108 months, followed by supervised release for life and to register as a sex 
offender. Additionally, he was required to pay a $100 criminal assessment . 

5. Maccini was titled as a subject on December 5, 2006 in cooperation with the 
Massachusetts State Police. Maccini was indicted on December 20, 2006 on child pornography 
charges, including distribution based upon information provided by the DCIS Minneapolis Post 
of Duty. Maccini was sentenced on December 12, 2007 to 5 years probation in Massachusetts 
state court. 


The Illinois Attorney General’s office has r equested assistance for an e-mail associate of 

Information related to distribution of child 


Shankey’ s going by the name 


l(bK6),(bX7)(C) 


p ornography by this e-mail account was provided. On February 21, 2008, McConnaughay, aka. 

was charged in Illinois with possession and dissemination of child 


(b)(6).(bX7XC) 


pornography, class 3 and class 1 felony respectively. On May 29, 2009, McConnaughay was 
sentenced in McHenry County Illinois pursuant to a plea agreement on a Class 3 felony charge of 
possession of child pornography. He is to serve 4 months incarceration, 2 years probation, pay a 
$1,00 fine and register as a sex offender. 

7. The FBI, Kansas City requested assistance with another associate of Shankey’s using the 

Information was retrieved from Shankey’s computer showing 13 


screen name 


[(bX6),(b)(7XC) 


messages between Shankey and _ _ This information was provided to assist in their 

prosecution. AUSA Roseann Ketchmark, Western District of Missouri advised that on July 10, 
2009, Ronald Elmquist <b)(6),(bK7,!C) ; pled guilty to attempted possession of child pornography 

in violation of Title 18, United States Code Section 2252 (A)(4)(B) and (B)(2). On October 30, 
2009, Elmquist was sentenced to 30 months incarceration, 5 yrs supervised release, 120 hours of 
community service, 12 months of home detention, participate in sex offender counseling, register 
under the Sex Offender registration and Notification Act, a $150,000 fine, and $100 special 
assessment. 


8. All known subjects associated with this case have been sentenced. This case is therefore 
being closed as completed. Any evidence will be disposed of in accordance with DCIS policy. 
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EXHIBITS - Previously submitted. 


Prepared by: SA 


[(b)(6).(b)(7)(C) 


Minneapolis Post of Duty 


APPR' 





(Investigations) 


DEPARTMENT OF DEFENSE 
OFFICE OF INSPECTOR GENERAL 
DEFENSE CRIMINAL INVESTIGATIVE SERVICE 
ARLINGTON RESIDENT AGENCY 
201 12 th STREET SOUTH, SUITE 712 
ARLINGTON, VIRGINIA 22202-5408 


REPORT OF INVESTIGATION 


200701301F-20-JUN-2007-60DC-W1/F April 9, 2009 

SWEENEY, DANIEL JOSEPH 


DISTRIBUTION: 


Defense Criminal Investigative Service Headquarters, National Security Pro gram (03NS) 
Immigration and Customs Enforcement, SAC Washington, D.C. (SA 


(bX6), (b)(7)(C) 


CLASSIFICATION: 


FOlTOFTOAy^^ 

im^FmcmEm^rnTNi 


WARNING 

Ttrfs^oeuwaiLjUheproperty of the Department of Defense Ins pector General a nri-is-en 
loan to your anancv~~OTTTtente^ not he rlisclp s^ fft-rtriy |'hi ly Tn?l°r inv‘“jt l QPti n n nor 
may this rlnciirnentJM ^hibulbiFOTlside~mHT , e<!eMa L-aaency w ithout specific prior 
authorization orthe Deputy Inspector General for Investigations. 




20070 1 30 1 F-20-JUN-2007-60DC-W1/F 


April 9, 2009 



WARNING 

nt is the property of the Department of Defense Inspector General and is on 


' not be disclosed t 


nonzation of the Deputy Inspector General for Investigations?' 


ny party nndemiivesltgaEbn nor 
agency without specific prior 


CLASSIFICATION: 


5. On June 21, 2007, a search warrant was executed on Sweenev’s residence located atK 6) ' <bX7) 

[(b)(6), (b)(7)(C) I 


6. During a non-custodial interview of Sweeney, he stated that he was active duty U.S. 
Navy, E-6 and worked at the Navy Yard in Washington, D.C. | (bK6),(b K7WC) _ 

(b)(6),(b)(7)(C) 

' 


7. Sweeney stated that he was aware that downloading and possessing child pornography 
was a violation of law. He admitted to accessing child pornography while stationed on the 
U.S.S. Mason. He said a few guys on the ship saw him doing it and warned him to stop. 


8. During the search warrant, agents seized two laptop computers, one external hard disk 
drive, one thumb drive, two memory cards, and approximately 77 other media items from the 


NARRATIVE: 


1 . On May 29, 2007, the DCIS, Arlington Resident Agency, initiated Project: Operation 
Flicker (CCN: 200701 199X) based on information provided by Assistant U.S. Attorney (AUSA) 
Gerald Smagala, U.S. Attorney’s Office (USAO), Eastern District of Virginia (EDVA), 
Alexandria Division. AUSA Smagala advised that the ICE was conducting a national 
investigation that identified over 5,000 individuals who subscribed to predicated child 
pornography websites. AUSA Smagala specifically requested DCIS assistance relative to any 
identified DoD personnel. 


2. sa [‘ 0)<6),(0>(7>1C) | utilized information contained within the DoD Employee 

Interactive Data System and the Joint Personnel Adjudication Systems (JPAS) to identify DoD 
affiliated individuals. Among those identified was Da niel Joseph Sweeney, an Active Duty. 
Petty Of ficer Second Class CE-5). with the IJ.S. Naw. , 

1(b)(6), (b)(7)(C) 


1(B)(6), (b)(7XC) 


3 . AUSA Smagala advised that Sweeney 

|(B)(6).(b)(7)(C) 


[iiswr 


background, Paypal is an account based system that lets anyone with an email address securely 
send and receive online payments using their credit card or bank account. 


Informatio n derived from Operatio n Flicker reveal ed that Sweene vl 16 ^ 1 ^ 7 ^ 
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residence. Computer forens ics revealed child p ornogra phy on o ne of the l aptop co mputers 
belonging to Sweeney. 

(b)(6), (bX7)(C) 


9. The recovered images were submitted to the National Center for Missing and Exploited 
Children (NCMEC) in Alexandria, Virginia. The NCMEC reported that images recovered from 
Sweeney’s residence included children previously identified by law enforcement as victims of 
sexual abuse. 

10. On October 7, 2008, a warrant was issued for the arrest of Sweeney by the U.S. District 
Court (USDC), EDVA. On October 8, 2008, agents executed an arrest warrant on Sweeney in 
Norfolk, Virginia, where he was station aboard the U.S.S. Anzio. 

11. On October 23, 2008, Sweeney was indicted in the Eastern District of Virginia on two 
counts of attempted receipt of child pornography and possession of child pornography, a 
violation of Title 18, U.S. Code (USC), Sections 2252A(a)(2) and 2252A(a)(5)(B). 

13. On December 12, 2008, Sweeney appeared before the Honorable James C. Cacheris, 
District Judge, USDC, EDVA, Alexandria Division. Sweeney pled guilty to a single count of 
possession of child pornography, a violation of Title 18, USC, Section 2252A. 

14. On March 13, 2009, Sweeney was sentenced to 41 months incarceration, 240 months 
supervised release, and a $100 penalty, for the possession of child pornography, a violation of 
Title 18, USC, Section 2252A 

15. No further criminal, civil or administrative activity by the DCIS will occur. This case is 
closed as “finished.” 
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Hair 
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Residence 

Employment/ Occupation 
Telephone Number 
Driver’s License Number 
and Issuing State 
Education 


Sweeney, Daniel Joseph 
None 



Unknown 

Unknown 


Unknown 


Prepared by Special Agent 


|(bj(6j,(b)(7XC)" 


Arlington Resident Agency 


^pp£. |(b)(6),(=;(7)!c; 


B-l 


CLASSIFICATION: 




WARNING 

gnt is th e property of the Department of Defense Inspec tor General^ Btus on 
loan to vour~i5enCT--€teBtefl fs may not be disclosed investigation nor 

may this documen t he disln bui^^Bfstfl^^ lSeivino anencv without specific prior 
authefkaliuii Of UiITDeputy Inspector General for InvestigaTT 






(Investigations) 


DEPARTMENT OF DEFENSE 

INSPECTOR GENERAL 

DEFENSE CRIMINAL INVESTIGATIVE SERVICE 
ARLINGTON RESIDENT AGENCY 
201 12 th STREET SOUTH, SUITE 712 
ARLINGTON, VIRGINIA 22202-5408 


REPORT OF INVESTIGATION 


200701341T-26-JUN-2007-60DC-W1/F November 23, 2009 

CAMPBELL, CAMERON MORRISON 


DISTRIBUTION: 

DCIS Headquarters, National Security Program (03NS) 


CLASSIFICATION: 


fmO££jCIALiJS&^^ 

LAW-ENFOR^^ 


WARNING 

nt is the property of the Department of Defense Inspecto r Genera l and Js -on 
loan to your jteCTr-eeiaent s_may not be discjosg&ja jay-peHt^^ nor 

may this document be-ji ist4hati?^SW^ffiiLte ffiivina ag ency without specific prior 
lor the Deputy Inspector General for Investigate 




20070 1341 T -26- JUN-2007-60DC- W 1 /F . 


November 23, 2009 


NARRATIVE: 

1 . This case was initiated based on information derived from Defense Criminal 
Investigative Service (DCIS) Project: Operation Flicker (Case Control Number 200701 199X). 

2. As background, on May 29, 2007, the DCIS Arlington Resident Agency, initiated 
Project: Operation Flicker based on information provided by Assistant U.S. Attorney (AUSA) 
Gerald Smagala, U.S. Attorney’s Office, Eastern District of Virginia, Alexandria Division. 
AUSA Smagala advised that the Immigration and Customs Enforcement was conducting a 
national investigation that identified over 5,000 individuals who subscribed to predicated child 
pornography websites. AUSA Smagala specifically requested DCIS assist in identifying DoD 
affiliated individuals and provide investigative assistance. 


3. Cameron Morrison Campbell was identified a # bM(b 

6)(7)(C) 




4. On June 28, 2007. agents executed a s e ar c h wa rrant on Campbell’s residence located at 
' ><6) ) Subsequen t to the execution of the search 

warrant, agents conducted a non-custodial interview of Campbell. [ (b)(a) ' (bi(7)(C > 





5. On August 6, 2009, a criminal information was filed against Campbell for receipt of child 
pornography, a violation of Title 18, U.S. Code, Section 2252A(a)(2). 


6. On August 26, 2009, Campbell pled guilty to receipt of child pornography, a violation of 
Title 18, U.S. code, Section 2252A(a)(2). 


7. On November 20, 2009, Campbell appeared before the Honorable Gerald Bruce Lee, 
District Judge, U.S. District Court, Eastern District of Virginia, Alexandria, Virginia and was 
sentenced to 60 months in prison, 60 months supervised released, and a $100 penalty assessment. 
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Race 
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Employment/Occupation 
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Driver’s License Number 
and Issuing State 
Education 



Unknown 

Unknown 

Unknown 

Unknown 

Unknown 
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NARRATIVE 


I. This investigation was initiated based on information derived from DCIS Project: 
Operation Flicker (Case Control Number 200701 199X). Flicker was initiated based upon a 
national ICE investigation which identified over 5,000 individuals who subscribed to predicated 
child pornography websites. DCIS was requested to assist in the identification and investigation 
of DoD affiliated individuals. 


2 . 


(b)(6), (b)(7)(C) 


DCIS, utilized information contained within the DoD Employee 


Interactive Data System and the Joint Personnel Adjudication Systems (JPAS) to identify DoD 
employees who subscribed to the websites. Among those identified was Paul Burnell Jones, a 

1 J 'l — — T 


Contract Specialist with the 

(b)(6), <b)(7XC) 

(OXpmDX'XC) 




3. Based on information obtained from ICE regarding Jones* subscriptions to known child 
pornography sites, agents from DCIS and ICE executed a search warrant on Jones’ residence on 
July 25, 2007. Jones’ residence was located at | ( 


!(bX6),(bX7)(C) 


(b)(6), (bX7XC) 


In addition a warrant was executed at Jones’ office located af 


|(bX6),(bX7)(C)| 


(b)(6), (b)(7)(C) 

ICE, conducted a non-custodial interview of Jones. Jones admitted to 



(b)(6), (b)(7)(C) 


(bX6),(b) 

exc)_ 

further 

provided he regularly accessed child pornography fromj l ' ),(b,,ltlK ' KW 



5. On July 25, 2007, a search warrant was executed on the home of Jones 1 


[(b)(6), (b)(7)(C) 


MM] 

(7X0 


6. On October 11, 2007, Jones pled guilty to one count of Attempted Receipt of Child 
Pornography, a violation of Title 18 U.S.C 2252A(b)(l). 

7. On January 1 1, 2008, Jones was sentenced to 60 months in prison and 120 months 
supervised release. Jones was also fined $2,000 in restitution and a $100 special assessment fee. 

8. No fraud vulnerabilities were discovered during the course of this investigation. No 
further criminal, civil or administrative actions will be taken on this matter. The case is closed as 
“finished.” 
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IDENTIFYING DATA 
Paul Burnell Jones 
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NARRATIVE: 

1 . This case was initiated based on information derived from Defense Criminal 

Investigative Service (DCIS) Project: Operation Flicker (Case Control Number 200701 199X). 

As background, on May 29, 2007, the DCIS, Mid-Atlantic Field Office (MAFO), initiated 
Operation Flicker based on information provided by Assistant United States Attorney (AUSA) 
Gerald Smagala, United States Attorney’s Office (USAO), Eastern District of Virginia, 
Alexandria Division. AUSA Smagala advised that the Immigration and Customs Enforcement 
(ICE) was conducting a national investigation that had identified over 5,000 individuals who 
subscribed to predicated child pornography websites. AUSA Smagala specifically requested that 
DCIS assist in identifying Department of Defense (DoD) affiliated individuals and provide 
investigative assistance. 


SA 


1(b)(6), (b)(7)(C) 


utilized information contained within the DoD Employee Interactive 


2 . 

Data System (DEIDS) and the Joint Personnel Adjudication Systems (JPAS) to identify DoD 


affiliated individuals. Among those identified was ib)(B >'< bi(7,(ci | a civilian with 

an unknown DoD agency. A query of JPAS revealed that he was a civilian contract employee 
within the Office of the Secretary of Defense, and held a top secret clearance. Law enforcement 
database checks were conducted and no criminal history was located for|£f ,(b)(7) | A check of the 
Defense Central Index of Investigations (DCII) revealed one record for [j 


(bX6),(b) 

iiZXC). 


A query of the 


Investigative Data System revealed no open or closed investigations of 


3. 


On July 10.2007, SA( 


!(bX6) 




immediate supervisor f 


(b)(0), (b)(7)(C) 


and SAp 


(b)(6) 


met withl (b)(6 ) 


to obtain|{c f >,(b i ‘ 7> [work computer. 


mmm" 

(C) . 


advised 


a subpoena or search warrant was required for him to release the computer and that he would 
safe guard the computer in the interim. 


On July 10, 2007, DCIS and ICE executed a search warrant atp (S) '^ X7) 


KbX6),(b)(7XC) 


1(0 


residence. SA 

was the primary Seized Computer Evidence and Recovery Specialist (SCERS) 
during the execution the search warrant . During the search warrant ICE entered all evidence 
into their evidence system and transferred all electronic media items to SA ! (cf )(bX7i ] SAj<c) <6><b)<7) _ 


used the Forensic Toolkit Imager and created a primary and secondary forensic image copy of all 
electronic media. The primary image copy was made on a 500 Giga Byte (GB) Western Digital 
hard drive that had a serial number WCANU2233037. A secondary image copy was made on a 
500 GB Western Digital hard drive that had a serial number WCANCU223888. Both primary 
and secondary image copies were entered into the DCIS evidence custody system (ECS) on July 
10, 2007 under evidence log # 0003-08. 


5. On November 29, 2007, SA 


(b)(6), (b)(7)(C) 


l(bX6). (b)(7)(C) 


served a search warra nt via facsimile to the 

[ The search warrant was 


issued from the U.S. District Court, Eastern District of Virginia, Alexandria Division, by the 
Honorable Barry R. Portez, U.S. Magistrate Judge. The search warrant requested electronic mail 
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(e-mail) subscriber information and e-mails sent and received : 
account. 


l(b)(6).(b)(7)(C) 


E-mail 


6. On Decemb er 3, 2007, SA (b > (6)(b) ™ 0) received documents and a compact disk 

(CD) from|c) (6|,!b)(71 pursuant to the search warrant that was served on November 29, 2007. 

7. On January 3, 2008, AUSA Smagala advised that an affidavit was not necessary to seize 
the work computer ofj£f Wb)(7) 

8. On February 4, 2008, AUSA Smagala requested that th e forensic examination of the 

home computerize; !c! be comp leted byp ir6) ' (b)(7)1C) _ 


9. On May 1 9, 2008, SAp y(6| ’ (b)(7)<C) 

was not needed to obtain |£f ,(b)(7y ] work 


ilMeiMT) 
‘(c; 


computer. 


he verified that a search warrant 


On September 9, 2008, SA 


i(bX6),(bX7)(C) 


met wit 


T(EX6);(b)(7) 

* (61 at 


(b)(6), (b)(7)(C) 


obtained 


the original h a rd drive o f the work laptop computer that was issued i 


provided 


J(b)(6);(bX7j(C) 


|w(6),(b)(7)| aiso 


sic report on work laptop computer. 


On September 15, 2008, 


1 1(b)(6). (b)(7XC) 


J(bX6Mb)(7X0r 


forensic report 


regarding (C) 6i <bii7) work laptop and the results indicated there was no evidence of child 


pornography orjjcf ),(b)!7) 


work laptop computer. 


On September 20 , 2008 , 


>X8).!b!(?XC) 


j(bX6),(bj(7XC) 


and she requested all offcf i,(b)(7) electronic piedia obtained from thefZI'^ 
warrant, be transferred back to ICE. 


residence search 


media to!Zc) ,(b) 


On September 25, 2008, SA( (bi(f 
esidence search warrant to SA| ( 
o[«]fbr forensic analysis. 


[returned all electronic media obtained from the 
| §^j(b)(6),(b)(7xc) | t j ien f orwar d e d all electronic 


14. On February 5, 2009, SA l (b)(6) ' (b)(7)(q was contacted by SA [ (bl 6)l and she disclosed 

information that the forensic report from reveal ed that the|ZS' <b> electronic media 

contained no evidence of child pornography violations. As a result, AUSA Smagala declined 
federal prosecution. 


15. On March 26, 2009, SAf mmmc) met with j”*] and returned confiscated wor k 

laptop hard drive back to Lockheed Martin . |cf il(b>(7> stated he will update ibK6),(bl(7)(C1 

(bx(i),(bxo( 0 ) regarding AUSA Smagala’s decision not to prosecute 
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16. 


(b)(S).(&X 7 ) 

(C) 


A review of flf )-(bK7) personal email and the results of the computer forensic reports of 
[personal and work computers did not reveal evidence related to the receipt of child 
pornography. AUSA Smagala declined to criminally prosecute [j b f >,(b)i71 j for violations relating to 
possession and/or receipt of child pornography, due to insufficient evidence. DCIS will take no 
further criminal, civil, or administrative actions on this matter. This case is closed as “declined.” 
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EXHIBIT: 


1 . U.S. Attorney’s Office, Eastern District of Virginia Electronic Forensic Examination 
Report, dated October 7, 2008. 


Prepared by Special Agent 


((b)(6), (bX7)(C) 


Arlington Resident Agency 
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